What is LP_LICENSE.INFORMATION file?

[Oldacres A]

Hi,

I have taken over admin duties on several Vaxes and Alphas with versions ranging from V6 to V7.1-H1. On some of these servers there are the following directories:

SYS$SYSDEVICE:[SYS0.SYSR]
SYS$SYSDEVICE:[SYS0.SYSRB]

and in each of these directories there is this file:

Directory SYS$SYSDEVICE:[SYS0.SYSR]
LP_LICENSE.INFORMATION;1 18 21-OCT-1998 10:59:08.86 [1,1] (RW,RW,RW,RW)
Directory SYS$SYSDEVICE:[SYS0.SYSRB]
LP_LICENSE.INFORMATION;1 18 21-OCT-1998 10:59:08.98 [1,1] (RW,RW,RW,RW)

The date of the files are different on different servers, the earliest I have seen is May 1995. The contents are binary data and gibberish to me.

I need to lock down the security on these objects to remove group and world write access, and would be less nervous about doing so if I had a handle on what these files are for.

Does anyone recognise these file names, know what they are for, or advise on changing the protection codes?

Thanks in advance,

[Steven Schweda]

Ask the fellow who created them? Around
here, there is no *.INFORMATION anywhere on
the system disk.

The normal (default) license data base is
something like SYS$SYSTEM:LMF$LICENSE.LDB
(here, SYS$COMMON:[SYSEXE]LMF$LICENSE.LDB),
but there's probably some logical name which
could allow it to be called something else.

Without seeing the gibberish, it's hard to
guess what it might be. DUMP?

[Oldacres A]

I have already asked this question internally - no answers.

I have searched the system directories for any references - nothing...

No logical name definitions - nothing...

Did a file dump which was very unexiting. I can post the results if there is interest.

I am considering putting an audit alarm on the file to flag all read/write accesses and see what bubbles to the surface.

My suspicion is that this is a hang-over from a restore of some sort. What I would really like to avoid is a phone call at 3am following a system restart.

[Hoff]

They're probably just files left over from the adventures of some earlier system manager. System archeology is always entertaining.

A DUMP might well show some details of the file contents, but a file with that name might also contain license checksums or other such that somebody might not want to see posted here.

There's a list of standard OpenVMS files and of recommended protections in the back of the security manual. You can also pull this list of files out of PCSI using PRODUCT commands. Files provided by VMSINSTAL are rather more difficult to track, unfortunately.

I'd start with the core files and protect outward. Some folks go gonzo protecting AUTHORIZE and such, when it's really SYSUAF and RIGHTSLIST and such that matter -- access into AUTHORIZE itself doesn't really matter. If I'm feeling mildly devious, I'll ensure that AUTHORIZE is readable per OpenVMS recommended default protections or otherwise, and will hang an audit ACE off AUTHORIZE and will then watch for the unusually inquisitive. (With SYSUAF itself protected, AUTHORZE can't access it from an unprivileged user context.) But I digress.

Start with the core system and the core application files, and protect outward.

You can also look at what has arrived on the distribution. I don't ever recall seeing a file with this name around, and Google turns up nothing.

The SYS$SYSDEVICE:[SYS0.SYSR] and [SYS0.SYSRB] directories also aren't typical directories I've seen around, either. That too looks entirely local, or something from a locally-installed application or product. If in your situation, I'd be investigating the ownership and contents and the necessity of the whole subdirectories involved here.

Stephen Hoffman
HoffmanLabs

[John Gillings]

I don't believe they're OpenVMS files either. You really do need to close up that W:RW!

They may belong to a 3rd party product. If you want to be sure they're not used, you could place an audit ACE on them:

(AUDIT=SECURITY,ACCESS=R+W+E+D+C+S+F)

Check your audit journal after a week or two to see if they've been accessed, (and by whom). Might be worth including a shutdown and reboot in your sample period, as that's one likely time that license information is checked.

[David B Sneddon · Accepted solution]

I believe they relate to software from RAXCO.
We use their CONTRL product and have those directories
and files...

Try DIR SYS$HELP:*.RELEASE* and see if there are
any files beginning with RAX.

Not sure about the protection -- try changing it
and see who complains.

Dave

[Oldacres A]

David:

You shoot,
Your score!

Perfect answer. Thats what they are - RAXCO license files. I did not spot them earlier as the RAXCO stuff is installed off the system disk.

I added an audit ace, found and ran the "LICINFO" procedure and sure enough up popped the audit alert.

I have removed the G+W:W access.

Many thanks for help everyone.

[Oldacres A]

Thread closed